Missing Authorization Vulnerability in youlai-boot Affected by Role Menu Assignment Issues

CVE-2026-110215

What is CVE-2026-110215?

In versions of youlai-boot prior to 2.21.1, a missing authorization vulnerability allows authenticated users to manipulate menu and button permissions for roles through an unsecured API endpoint. This flaw can be exploited by low-privileged users, such as the GUEST test account, enabling them to grant excessive permissions to their own roles and refresh the Redis permission cache. As a result, these users can achieve administrator-equivalent access, significantly compromising the security posture of the affected systems.

References